GitHub Advisoryadvisory · npm

GHSA-354r-7mfh-7rh2 OpenClaw: Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups

MEDIUM Published 2026-03-03 Modified 2026-03-20 Official page ↗
Aliases
CVE-2026-32028
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-863
Reviewed
2026-03-03

Affected packages

• npm openclaw: < 2026.2.25 → fixed in 2026.2.25

Description

Summary In OpenClaw `= 2026.2.25` Fix Commit(s) • `aedf62ac7e669a89c7b299201bf6537dc6b12e0e` Release Process Note `patched_versions` is pre-set to the release (`2026.2.25`) so after npm release the advisory is published. Thanks @tdjackey for reporting.

Related

Alias · CVE (1)

  • CVE-2026-32028 OpenClaw versions prior to 2026.2.25 fail to enforce dmPolicy and allowFrom authorization checks on Discord direct-message reaction… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References